Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: handle a scratch/busybox/DockerSlim image gracefully #476

Merged
merged 5 commits into from
Apr 30, 2020
Merged

fix: handle a scratch/busybox/DockerSlim image gracefully #476

merged 5 commits into from
Apr 30, 2020

Conversation

knqyf263
Copy link
Collaborator

@knqyf263 knqyf263 commented Apr 26, 2020 •
edited by simar7
Loading

Overview

If an image is based on scratch, Trivy ignores a vulnerability scan of OS packages and scans only vulnerabilities of application dependencies. Note that the vulnerability of busybox is not detected.

Related Issues/PRs

Replace #470

Close #8
Close #355
Close #397

Blocker

@knqyf263 knqyf263 added the kind/bug Categorizes issue or PR as related to a bug. label Apr 26, 2020
@knqyf263 knqyf263 added this to the v0.7.0 milestone Apr 26, 2020
@knqyf263 knqyf263 requested a review from simar7 April 26, 2020 19:26
@knqyf263 knqyf263 self-assigned this Apr 26, 2020
@knqyf263 knqyf263 mentioned this pull request Apr 27, 2020
Closed
@knqyf263 knqyf263 changed the title fix: support a scratch image fix: handle a scratch/busybox/DockerSlim image gracefully Apr 27, 2020
@mattlorimor
Copy link

Note that the vulnerability of busybox is not detected.

@knqyf263, @simar7 - Would it be reasonable to create a new issue requesting the functionality for detecting the busybox version and CVEs in it to be added? At a quick glance, it appears like it'd be a potentially-okay first issue for somebody to tackle. If I can find some time, I could look at doing so. I just haven't dug into the source that closely yet.

Or is the request to detect vulnerable versions of busybox being referenced by this comment: #397 (comment)?

@simar7
update depdendencies and fix tests
017029c 
Signed-off-by: Simarpreet Singh <simar@linux.com>
simar7
simar7 reviewed Apr 28, 2020
View reviewed changes
go.mod Outdated
github.com/aquasecurity/go-dep-parser v0.0.0-20190819075924-ea223f0ef24b
github.com/aquasecurity/trivy-db v0.0.0-20200408191531-0a25a37ec16f
github.com/aquasecurity/trivy-db v0.0.0-20200427223346-73deea114f99
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be updated to point to master once aquasecurity/trivy-db#42 is merged.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I fixed it.
10ab9ac

simar7
simar7 reviewed Apr 28, 2020
View reviewed changes
integration/docker_engine_test.go
Comment on lines -233 to +239
expectedError: "unable to access the remote image (index.docker.io/library/badimage:latest)",
expectedError: "unable to inspect the image (index.docker.io/library/badimage:latest): Error: No such image: index.docker.io/library/badimage:latest",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@knqyf263 I wasn't able to figure out why this error has changed. Do you know?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you can find it here.
https://github.com/aquasecurity/fanal/pull/101/files#diff-525dd35201b72b43ad63b85dd2720ba6R66-R87

@simar7
Copy link
Member

simar7 commented Apr 28, 2020

Note that the vulnerability of busybox is not detected.

@knqyf263, @simar7 - Would it be reasonable to create a new issue requesting the functionality for detecting the busybox version and CVEs in it to be added? At a quick glance, it appears like it'd be a potentially-okay first issue for somebody to tackle. If I can find some time, I could look at doing so. I just haven't dug into the source that closely yet.

Or is the request to detect vulnerable versions of busybox being referenced by this comment: #397 (comment)?

Hi @mattlorimor the issue you're looking for is this #397 We would be glad to look into your code if you do decide to make a contribution! Please feel free to send us a pull request.

@simar7
Copy link
Member

simar7 commented Apr 28, 2020 •
edited
Loading

Close #355
Close #397

@knqyf263 since this doesn't still handle busybox and DockerSlim images, I think we can keep those issues for adding support for them.

And by supporting I mean detecting vulnerabilities in both busybox and DockerSlim images.

@simar7 simar7 self-requested a review April 28, 2020 16:30
@knqyf263
Copy link
Collaborator Author

knqyf263 commented Apr 28, 2020 •
edited
Loading

We don't have the plan to detect vulnerabilties of a self-compiled binary. "self-compile" means a package not installed by package manager such as yum. We support only packages installed by package manager. So, it's difficult to detect vulnerabilities of the busybox binary in a busybox image for now . If a user needs such a feature, I think it should be another issue like "feature request: support packages installed by make". It will support other binaries like the nginx binary in an nginx image.

@mattlorimor Yes, as you said, you can open the dedicated issue.

@knqyf263
Copy link
Collaborator Author

knqyf263 commented Apr 28, 2020 •
edited
Loading

@simar7 Maybe we should leave some comments about our limitation on those issues and close them. Then, it can be tracked by new issue opened by @mattlorimor

@knqyf263 knqyf263 mentioned this pull request Apr 30, 2020
Merged
@knqyf263 knqyf263 merged commit 216a33b into master Apr 30, 2020
@knqyf263
Copy link
Collaborator Author

knqyf263 commented Apr 30, 2020 •
edited
Loading

@simar7 Thank you for fixing tests. I opened the issue.
#481

@knqyf263 knqyf263 deleted the fix/scratch branch April 30, 2020 09:48
JorritSalverda added a commit to estafette/estafette-extension-docker that referenced this pull request May 1, 2020
@JorritSalverda
swallow os error until aquasecurity/trivy#476 is released
2108775
masahiro331 pushed a commit to masahiro331/trivy that referenced this pull request May 26, 2020
@knqyf263 @simar7 @masahiro331
fix: handle a scratch/busybox/DockerSlim image gracefully (aquasecuri…
786dfba 
…ty#476)

* fix: handle unknown OS and no package errors

* chore(mod): update dependencies

* integration: add busybox

* update depdendencies and fix tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* chore(mod): use the latest trivy-db

Co-authored-by: Simarpreet Singh <simar@linux.com>
GuaoGuao pushed a commit to GuaoGuao/trivy that referenced this pull request Jun 24, 2020
@knqyf263 @simar7
fix: handle a scratch/busybox/DockerSlim image gracefully (aquasecuri…
65eccf0 
…ty#476)

* fix: handle unknown OS and no package errors

* chore(mod): update dependencies

* integration: add busybox

* update depdendencies and fix tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* chore(mod): use the latest trivy-db

Co-authored-by: Simarpreet Singh <simar@linux.com>
liamg pushed a commit that referenced this pull request Jun 7, 2022
@knqyf263 @simar7
fix: handle a scratch/busybox/DockerSlim image gracefully (#476)
b640cd0 
* fix: handle unknown OS and no package errors

* chore(mod): update dependencies

* integration: add busybox

* update depdendencies and fix tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* chore(mod): use the latest trivy-db

Co-authored-by: Simarpreet Singh <simar@linux.com>
josedonizetti pushed a commit to josedonizetti/trivy that referenced this pull request Jun 24, 2022
@liamg
fix: ignore external source prefixes when filtering by file path (aqu…
e53d6cc 
…asecurity#476)

* fix: ignore external source prefixes when filtering by file path
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@simar7 simar7 simar7 approved these changes

Assignees

@knqyf263 knqyf263

Labels
kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Milestone
v0.7.0
Development

Successfully merging this pull request may close these issues.

Support BusyBox base image Support images minified with DockerSlim Add option to ignore Unknown OS
3 participants
@knqyf263 @mattlorimor @simar7